KVKK Privacy Notice

Privacy notice on how your personal data is processed under Turkey's Personal Data Protection Law No. 6698 (KVKK).

Last updated: 17 October 2026

This privacy notice is provided under Article 10 of Turkey's Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains how we process the personal data of people who visit icyabmod.com, use our forms, write to us on WhatsApp or by e-mail and buy our services. This English text is a translation for information; the Turkish version prevails.

1. Data Controller

Your personal data is processed by the data controller whose details are given below:

Phone
+90 544 842 28 04
WhatsApp
+90 544 842 28 04
Website
icyabmod.com

2. Personal Data We Process

  • Identity: full name.
  • Contact: e-mail address, phone number and country code.
  • Customer transaction: the subject and message of the contact form; the sections, designs, extra requests and calculated total you choose in the Quick Website order form; the content of WhatsApp and e-mail correspondence; texts and images you send us for the service.
  • Finance: if you buy a service, payment and invoice records (for example payment date, amount, transfer receipt). Card details are never collected on our site.
  • Transaction security: the IP address a form was sent from, the time it was sent and the time you ticked the confirmation box; browser and device information, server logs and session cookies. To count daily unique views of blog and service pages, we store not your IP address itself but an irreversible summary created with a secret key (HMAC-SHA256).
  • Campaign source: when you send the order form, which campaign or site you came from (UTM parameters, the referring site's domain, the first page opened) is stored with the order record; the ad click ID (gclid, gbraid, wbraid, fbclid) is added only if you have given explicit consent to marketing cookies.
  • Marketing and usage analytics (only with your explicit consent): cookie identifiers, page interactions and ad interactions collected through Google Ads, Meta Pixel and Microsoft Clarity cookies; when you send a form, an irreversible summary (SHA-256) of your e-mail address and phone number, the order number and the amount (Google Ads enhanced conversions and the Meta Conversions API).

We do not ask for special categories of personal data (health, biometric data and so on); please do not include such data in your messages.

3. Purposes of Processing

  • Answering your contact requests and questions
  • Reviewing your orders and quote requests and contacting you on WhatsApp or by e-mail
  • Entering into and performing the contract: preparing your website, showing it on our test server, giving you admin panel access, launching it and managing renewal periods
  • Handling payments, invoices and accounting, and meeting legal obligations
  • Preventing form abuse and spam, and keeping the site and information secure
  • Establishing, exercising and defending legal rights in case of disputes
  • Measuring which ad campaigns or sites orders come from
  • With your explicit consent: analysing how the site is used and measuring the results of Google and Meta advertising campaigns

4. Collection Methods and Legal Bases

Your personal data is collected electronically, partly by automated means, through the contact and order forms, WhatsApp and e-mail correspondence, payment records, and cookies and similar technologies. The legal bases are:

  • Entering into or performing a contract (KVKK Art. 5(2)(c)): reviewing orders and quote requests, concluding the contract and providing the service.
  • Legal obligation (KVKK Art. 5(2)(ç)): record-keeping duties under tax and consumer law and requests from authorities.
  • Establishing, exercising or protecting a right (KVKK Art. 5(2)(e)): keeping contract and correspondence records for possible disputes.
  • Legitimate interest (KVKK Art. 5(2)(f)): answering general enquiries, form security (spam and bot protection), counting page views using the IP summary, keeping form confirmation records as evidence, recording the campaign source of an order (UTM, referring site, first page opened) and running the site securely, provided your fundamental rights and freedoms are not harmed.
  • Explicit consent (KVKK Art. 5(1)): analytics and advertising cookies, adding ad click IDs to the order record, the transfers under Google Ads enhanced conversions and the Meta Conversions API, and the transfer abroad made through them. Your consent is requested separately and optionally in the cookie panel, and you can withdraw it at any time.

The tick box on our forms is for confirming that you have read this notice; it is not a declaration of explicit consent.

5. Transfers of Personal Data

  • Hosting and e-mail service providers: the servers the site runs on and the e-mail services that deliver form notifications.
  • Messaging: when we write to each other on WhatsApp, your messages are carried by WhatsApp (Meta). You can tell us that you prefer to be contacted by phone or e-mail instead.
  • Form security: through the Google reCAPTCHA service used on our forms, your IP address and browser/device information are sent to Google for bot and spam checks.
  • Analytics and advertising (only with your explicit consent): Google Tag Manager and Google Ads (Google LLC / Google Ireland Ltd.), Meta Pixel and the Meta Conversions API (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) and Microsoft Clarity (Microsoft Corporation). Your e-mail address and phone number are sent to Google and Meta only as a SHA-256 summary, never in plain form.
  • Authorities: public bodies and courts with legal authority and, where the law requires, professionals such as accountants.

Transfers abroad: Google, Microsoft and Meta may have servers outside Turkey (including the USA and the European Union). Under Article 9 of the KVKK as amended by Law No. 7499, transfers abroad are based on an adequacy decision of the Personal Data Protection Board where one exists, otherwise on appropriate safeguards offered by the provider (for example the standard contract published by the Board, KVKK Art. 9(4)). Where no such safeguard exists, transfers through analytics and advertising cookies, Google Ads enhanced conversions and the Meta Conversions API are based on the explicit consent you give after being informed of the possible risks, under KVKK Art. 9(6)(a). The possible risks are: the legal system of the destination country may not offer the same level of protection as the KVKK, foreign public authorities may access the data, and exercising your rights against a company abroad may be harder. Not giving consent does not stop you from using the site's main features.

6. Retention Periods

  • Contact form records and correspondence: 2 years from the last contact.
  • Orders and quote requests that do not become a contract: 2 years from the request.
  • Contract, payment and invoice records: 10 years from the end of the contract, without prejudice to retention periods under tax law.
  • Page view records (IP summary) and server security logs: up to 1 year.
  • IP address, confirmation time and campaign source of a form submission: kept with the related form record for the periods above.
  • Cookies: the periods stated in our Cookie Policy.

When the period ends, data is deleted, destroyed or anonymised in line with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

7. Your Rights Under KVKK Article 11

By applying to the data controller you have the right to:

  • learn whether your personal data is processed,
  • request information if it has been processed,
  • learn the purpose of processing and whether the data is used for that purpose,
  • know the third parties in Turkey or abroad to whom it has been transferred,
  • request correction if it is incomplete or inaccurate,
  • request deletion or destruction under the conditions of KVKK Article 7,
  • request that correction, deletion and destruction be notified to third parties the data was transferred to,
  • object to a result against you produced exclusively by automated analysis of the processed data,
  • claim compensation if you suffer damage because of unlawful processing.

You can withdraw consent given for consent-based processing at any time through the cookie preferences on the site.

8. How to Apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application in writing to the address above, by registered electronic mail (KEP), with a secure electronic signature or mobile signature, or from an e-mail address you have previously given us and that is in our records to info@icyabmod.com. Your application should include your full name, your Turkish ID number if you are a Turkish citizen (nationality and passport number if you are not), your address for notifications, your e-mail address and phone number if any, and the subject of your request.

Your application is concluded free of charge within 30 days at the latest; if the process involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient or no answer is given in time, you can complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the application date.

9. Changes

This notice is updated when our processing or the law changes. The current version is always published on this page. For other practices on the site, see our Privacy Policy and Cookie Policy.